Supply Chain Attacks: The New Reality
summary
Supply-chain attacks target build and distribution points, not just source code: Codecov container bash script exfiltrated repository credentials and a composer registry proof‑of‑concept shows package metadata injection can run commands on the registry. Reports estimate roughly 4x increase in 2021 and a 650% year‑over‑year rise in supply‑chain incidents. Practical defenses are a machine‑readable SBoM, automated scanning at package managers and CI, policy to hold packages younger than 30 days, and manual review for high‑risk or unmaintained components.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:15Software Supply Chain
- 2:45EU Threat Landscape Report
- 4:28State of Software Supply Chain
- 8:53Composer
- 14:08Know what the problem is
- 14:43Software Bill of Materials
- 17:23Machine readable
- 20:43Fix nothing
- 21:16How are we exposed
- 25:44There is no silver bullet
- 25:59The ecosystem
- 29:19Best practices
- 33:03Summary
- 34:44Outro
related talks
37mSupply Chain Attacks and the Future of Software Delivery
15mSupply chain security for dummies
25mSupply Chain Attacks
01h 02mProtect Yourself Against Supply Chain Attacks
07mHow to Secure Your End-to-end Supply Chain
38mSupply Chain Security & the Real World: Lessons From Incidents
16mThe Rise of Supply Chain Attacks
41mManaging the Risk of Software Supply Chain Attacks